Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

linux: omit build id #106648

Merged
merged 1 commit into from Dec 23, 2020
Merged

linux: omit build id #106648

merged 1 commit into from Dec 23, 2020

Conversation

raboof
Copy link
Member

@raboof raboof commented Dec 11, 2020

Motivation for this change

Don't include an ​NT_GNU_BUILD_ID (that is randomly generated
at build time).

This improves the kernel reproducibility (though there is
still some other remaining problems)

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@teto
Copy link
Member

teto commented Dec 11, 2020

please tartget staging instead.

layus
layus reviewed Dec 11, 2020
View reviewed changes
Copy link
Member

@layus layus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not know what the makefile looks like, but the regex looks brittle. It would turn --build-id=xxx to --build-id=none=xxx. It there a way to detect that of fail in such cases ? Will gcc behave correctly with --build-id=none=xxx ?

@layus
Copy link
Member

layus commented Dec 11, 2020

Oh, and thanks for investigating kernel reproducibility. That's not a easy one.

@prusnak
Copy link
Member

prusnak commented Dec 11, 2020

The sed command suggested here is the same as the one described in https://kernelnewbies.org/BuildId (which references https://github.com/mempo/mempo-kernel - probably used by Debian).

@FRidh
Copy link
Member

FRidh commented Dec 11, 2020

Wouldn't upstream accept a patch where you can more conveniently set the build id?

@raboof raboof changed the base branch from master to staging December 11, 2020 17:55
@Atemu
Copy link
Member

Atemu commented Dec 11, 2020

Have you tested whether the build ID is actually stable now? When I tried this a few weeks ago, it didn't work and the build id was still random.

You can extract the kernel using scripts/extract-vmlinux and then readelf -n to get the ID.

@ofborg ofborg bot requested review from layus and teto December 11, 2020 18:13
@raboof
Copy link
Member Author

raboof commented Dec 11, 2020

Have you tested whether the build ID is actually stable now? When I tried this a few weeks ago, it didn't work and the build id was still random.

Yes, it does look like it (though the readelf warning makes it so I'm not sure):

Without this PR:

Displaying notes found in: .notes
  Owner                 Data size	Description
  Xen                  0x00000006	Unknown note type: (0x00000006)	   description data: 6c 69 6e 75 78 00 
  Xen                  0x00000004	Unknown note type: (0x00000007)	   description data: 32 2e 36 00 
  Xen                  0x00000008	Unknown note type: (0x00000005)	   description data: 78 65 6e 2d 33 2e 30 00 
  Xen                  0x00000008	Unknown note type: (0x00000003)	   description data: 00 00 00 ffffff80 ffffffff ffffffff ffffffff ffffffff 
  Xen                  0x00000008	Unknown note type: (0x0000000f)	   description data: 00 00 00 00 ffffff80 00 00 00 
  Xen                  0x00000008	NT_VERSION (version)	   description data: ffffff80 31 44 ffffff82 ffffffff ffffffff ffffffff ffffffff 
  Xen                  0x00000008	NT_ARCH (architecture)   description data: 00 10 00 ffffff81 ffffffff ffffffff ffffffff ffffffff 
  Xen                  0x00000029	Unknown note type: (0x0000000a)	   description data: 21 77 72 69 74 61 62 6c 65 5f 70 61 67 65 5f 74 61 62 6c 65 73 7c 70 61 65 5f 70 67 64 69 72 5f 61 62 6f 76 65 5f 34 67 62 
  Xen                  0x00000004	Unknown note type: (0x00000011)	   description data: 01 ffffff88 00 00 
  Xen                  0x00000004	Unknown note type: (0x00000009)	   description data: 79 65 73 00 
  Xen                  0x00000008	Unknown note type: (0x00000008)	   description data: 67 65 6e 65 72 69 63 00 
  Xen                  0x00000010	Unknown note type: (0x0000000d)	   description data: 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 
  Xen                  0x00000004	Unknown note type: (0x0000000e)	   description data: 01 00 00 00 
  Xen                  0x00000004	Unknown note type: (0x00000010)	   description data: 01 00 00 00 
  Xen                  0x00000008	Unknown note type: (0x0000000c)	   description data: 00 00 00 00 00 ffffff80 ffffffff ffffffff 
  Xen                  0x00000008	Unknown note type: (0x00000004)	   description data: 00 00 00 00 00 00 00 00 
  GNU                  0x00000014	NT_GNU_BUILD_ID (unique build ID bitstring)	    Build ID: 6fe08243f4b43f38bf114798174991a5029dd47e
  Linux                0x00000001	OPEN	   description data: 00

With this PR:

readelf --wide --notes /nix/store/x3gw8wy4i7mms36x7bnbd3llbxqymfv8-linux-5.4.81-dev/vmlinux

Displaying notes found in: .notes
  Owner                 Data size	Description
  Xen                  0x00000006	Unknown note type: (0x00000006)	   description data: 6c 69 6e 75 78 00 
  Xen                  0x00000004	Unknown note type: (0x00000007)	   description data: 32 2e 36 00 
  xen-3.0              0x00000005	Unknown note type: (0x006e6558)	   description data: 08 00 00 00 03 
readelf: Warning: note with invalid namesz and/or descsz found at offset 0x50
readelf: Warning:  type: 0xffffffff, namesize: 0x006e6558, descsize: 0x80000000, alignment: 8

@raboof
Copy link
Member Author

raboof commented Dec 13, 2020

(I also verified that, when disabling MODULE_SIG and SECURITY_LOCKDOWN_LSM, it seems the kernel is now reproducible)

FRidh
FRidh reviewed Dec 17, 2020
View reviewed changes
pkgs/os-specific/linux/kernel/manual-config.nix
@@ -113,6 +113,7 @@ let
sed -i "$mf" -e 's|/usr/bin/||g ; s|/bin/||g ; s|/sbin/||g'
done
sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
sed -i Makefile -e 's|--build-id|--build-id=none|'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would appreciate a comment here explaining what this line is for.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 done

@raboof
linux: omit build id
bfffb51 
Don't include an ​NT_GNU_BUILD_ID (that is randomly generated
at build time).

This improves the kernel reproducibility: when also disabling
the MOUDLE_SIG and SECURITY_LOCKDOWN_LSM options the build
is bit-by-bit reproducible.
@raboof raboof requested a review from FRidh December 17, 2020 09:59
zimbatm
zimbatm approved these changes Dec 22, 2020
View reviewed changes
Copy link
Member

@zimbatm zimbatm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Atemu
Atemu approved these changes Dec 23, 2020
View reviewed changes
Copy link
Member

@Atemu Atemu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can confirm that the buildId section is now omitted, LGTM!

We're actually really close to a fully reproducible kernel now :0

@zimbatm zimbatm merged commit de075d2 into NixOS:staging Dec 23, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@zimbatm zimbatm zimbatm approved these changes

@Atemu Atemu Atemu approved these changes

@thoughtpolice thoughtpolice Awaiting requested review from thoughtpolice

@layus layus Awaiting requested review from layus

@teto teto Awaiting requested review from teto

@FRidh FRidh Awaiting requested review from FRidh

Assignees
No one assigned
Labels
6.topic: reproducible builds 10.rebuild-darwin: 0 10.rebuild-linux: 501+ 10.rebuild-linux: 1001-2500
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@raboof @teto @layus @prusnak @FRidh @Atemu @zimbatm